login[.]workshopvotereview[.]com

Analysis as of July 24 2026 indicates that the domain login.workshopvotereview.com was registered through Web Commerce Communications Limited on 25 October 2025. The domain resolves to 172.67.160.125, which belongs to Cloudflare Inc. (AS13335) and is geolocated in the United States. Its authoritative nameservers are emily.ns.cloudflare.com and khalid.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and edge services. No TLS certificate is presented; the site does not support HTTPS, which is atypical for legitimate login portals and increases exposure to man‑in‑the‑middle attacks. The page title returned by the server is “Kirjaudu sisään”, a Finnish phrase meaning “Log in”.

The domain is flagged by 14 of 95 security vendors on VirusTotal, indicating a moderate level of malicious consensus. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on at least one external blocklist, which has already triggered a takedown by PhishDestroy. The threat classification in the intelligence set is a “Gaming Scam” that impersonates the brand “cs2”. The combination of brand impersonation, a login‑oriented title, and the absence of a valid certificate aligns with typical credential‑harvesting infrastructure used in gaming‑related phishing campaigns.

Because the site is currently offline, active traffic is likely being blocked, but the infrastructure remains viable for future re‑use. Defenders should continue to block the domain at perimeter firewalls and DNS resolvers, monitor for any re‑registration of the same second‑level domain or similar subdomains, and consider adding the IP address 172.67.160.125 to deny‑list rules if not already covered by broader Cloudflare blocklists. Additional verification through threat‑intel feeds that reference the “cs2” brand impersonation pattern may reveal related campaigns. Until the domain is definitively removed from the threat landscape, it should be treated as malicious and excluded from trusted web‑access lists.